e4900605a66c25075dd65a421bd81f55f34ab9881c420605090b275badb6d202

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:43

Target

b954dbc69637b68c942c63e48cb5fbd0_exe32.exe
Size

268KB
MD5

b954dbc69637b68c942c63e48cb5fbd0
SHA1

9ea65f1ab02119c43e97ae1647d8c1a44e9bffa5
SHA256

e4900605a66c25075dd65a421bd81f55f34ab9881c420605090b275badb6d202
SHA512

c9fbe564e1129fcd86a3e6896154002f9f31d2f6d84f657e0572d99b0443591548a631cd1c6f70fde2e50e03831d252863f93446feb4f5fc384fa38028787402
SSDEEP

1536:S5zXF8CvrJ4PBhDP35RSIH4rjXq+66DFUABABOVLefE:Sh8k6DP3bSIH4j6+JB8M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3064	2820	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3064	2820	b954dbc69637b68c942c63e48cb5fbd0_exe32.exe	16
PID 2820 wrote to memory of 3064	2820	b954dbc69637b68c942c63e48cb5fbd0_exe32.exe	16
PID 2820 wrote to memory of 3064	2820	b954dbc69637b68c942c63e48cb5fbd0_exe32.exe	16
PID 2820 wrote to memory of 3064	2820	b954dbc69637b68c942c63e48cb5fbd0_exe32.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 36
1⤵
- Program crash
PID:3064

C:\Users\Admin\AppData\Local\Temp\b954dbc69637b68c942c63e48cb5fbd0_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\b954dbc69637b68c942c63e48cb5fbd0_exe32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

memory/2820-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download